CVE-2019-9517
| Affected software | 7 products, listed below |
|---|---|
| Severity | 7.5 High CVSS 3.1 3 scores |
| Weakness | Uncontrolled resource consumption (CWE-400) |
| Published | 13 Aug 2019 |
| Updated | 17 Jun 2026 |
Description
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
CWE-770
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 7 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 27% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 3.0 | 7.5 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
cret@cert.org | Secondary | |
| CVSS 2.0 | 7.8 | none | AV:N/AC:L/Au:N/C:N/I:N/A:C |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2019 ↗ | CPU | 2019-Q4 | Oracle Enterprise Manager / OS Provisioning (Apache HTTP Server) (12.3.3, 12.4.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Enterprise Manager | OS Provisioning (Apache HTTP Server) | 12.3.3, 12.4.0 | 12.3.3 · 12.4.0 |
Products and versions
23 products, 40 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | http server | generic | ≥ 2.4.20 and ＜ 2.4.40 |
| nvd | apache | traffic server | generic | ≥ 6.0.0 and ≤ 6.2.3 · ≥ 7.0.0 and ≤ 7.1.6 · ≥ 8.0.0 and ≤ 8.0.3 |
| nvd | apple | swiftnio | generic | ≥ 1.0.0 and ≤ 1.4.0 |
| nvd | canonical | ubuntu linux | generic | 16.04 · 18.04 · 19.04 |
| nvd | debian | debian linux | generic | 9.0 · 10.0 |
| nvd | fedoraproject | fedora | generic | 29 · 30 |
| nvd | mcafee | web gateway | generic | ≥ 7.7.2.0 and ＜ 7.7.2.24 · ≥ 7.8.2.0 and ＜ 7.8.2.13 · ≥ 8.1.0 and ＜ 8.2.0 |
| nvd | netapp | clustered data ontap | generic | any version |
| nvd | nodejs | node.js | generic | ≥ 8.0.0 and ≤ 8.8.1 · ≥ 8.9.0 and ＜ 8.16.1 · ≥ 10.0.0 and ≤ 10.12.0 · ≥ 10.13.0 and ＜ 10.16.3 · ≥ 12.0.0 and ＜ 12.8.1 |
| nvd | opensuse | leap | generic | 15.0 · 15.1 |
| nvd | oracle | communications element manager | generic | 8.0.0 · 8.1.0 · 8.1.1 · 8.2.0 |
| nvd | oracle | graalvm | javase | 19.2.0 |
| nvd | oracle | instantis enterprisetrack | generic | ≥ 17.1 and ≤ 17.3 |
| nvd | oracle | retail xstore point of service | generic | 7.1 |
| nvd | redhat | enterprise linux | generic | 8.0 |
| nvd | redhat | jboss core services | generic | 1.0 |
| nvd | redhat | jboss enterprise application platform | generic | 7.2.0 · 7.3.0 |
| nvd | redhat | openshift service mesh | generic | 1.0 |
| nvd | redhat | quay | generic | 3.0.0 |
| nvd | redhat | software collections | generic | 1.0 |
| nvd | synology | diskstation manager | generic | 6.2 |
| nvd | synology | skynas | generic | any version |
| nvd | synology | vs960hd firmware | generic | any version |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, NO AUTH REMOTE EXPLOIT, OS PROVISIONING (APACHE HTTP SERVER) **Products:** HTTP/2
References
| URL | Tags |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html | Mailing List, Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html | Mailing List, Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html | Mailing List, Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2019/08/15/7 | Mailing List, Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2893 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2925 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2939 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2946 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2949 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2019:2950 | Third Party Advisory |
Timeline
Timeline
| Published | 2019-08-13 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |